freeradius/freeradius-bootstrap-fixed-dhparam.patch

53 lines
1.3 KiB
Diff

From b31f1ab9a0e1c010037d2d660e3ce4ea7eb07d6c Mon Sep 17 00:00:00 2001
From: Alexander Scheel <ascheel@redhat.com>
Date: Wed, 5 Aug 2020 16:10:52 -0400
Subject: [PATCH] Use fixed FIPS-approved dhparam by default
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
---
raddb/certs/Makefile | 2 +-
raddb/certs/bootstrap | 7 +++++--
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/raddb/certs/Makefile b/raddb/certs/Makefile
index 5cbfd46..41b7aea 100644
--- a/raddb/certs/Makefile
+++ b/raddb/certs/Makefile
@@ -59,7 +59,7 @@ passwords.mk: server.cnf ca.cnf client.cnf inner-server.cnf
#
######################################################################
dh:
- $(OPENSSL) dhparam -out dh -2 $(DH_KEY_SIZE)
+ cp rfc3526-group-18-8192.dhparam dh
######################################################################
#
diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
index 9920ecf..59b3310 100755
--- a/raddb/certs/bootstrap
+++ b/raddb/certs/bootstrap
@@ -13,6 +13,10 @@
umask 027
cd `dirname $0`
+if [ ! -e random ]; then
+ ln -sf /dev/urandom random
+fi
+
make -h > /dev/null 2>&1
#
@@ -35,8 +39,7 @@ fi
# re-generate these commands.
#
if [ ! -e dh ]; then
- openssl dhparam -out dh 2048 || exit 1
- ln -sf /dev/urandom random
+ cp rfc3526-group-18-8192.dhparam dh
fi
if [ ! -e server.key ]; then
--
2.26.2